### 简要描述：
过滤不严。
### 详细说明：
虽然有全局转义 但是在plugins/gov.order/order.php中
```
function m__save_order(){
global $dbm;
//判断登陆
if(!isset($_SESSION['uid']) || !isset($_SESSION['uname'])) die('{"code":"100","msg":"你还没有登陆，请登入后再购买"}');
$info_id = $_POST['info_id'];
$info_title = urldecode($_POST['info_title']);
$price = isset($_POST['price'])?$_POST['price']:0;
$number = isset($_POST['number'])?$_POST['number']:0;
if(!is_numeric($price)) die('{"code":"100","msg":"价格必须是数字"}');
if(!is_numeric($number)) die('{"code":"100","msg":"数量必须是数字"}');
if(intval($price)<=0) die('{"code":"120","msg":"购买数量不能少于1"}');
if(strlen($_POST['rev_user'])<2) die('{"code":"100","msg":"收货人姓名必须填写"}');
if(strlen($_POST['rev_addr'])<6) die('{"code":"100","msg":"收货人地址必须填写"}');
if(strlen($_POST['rev_phone'])<8) die('{"code":"100","msg":"收货人手机必须填写"}');
$params['order_content'] = '';
$params['pay_total'] = 0;
$params['order_content'] .= $price."元 x ".$number."";
$params['pay_total'] += $number*$price;
//订单数据
$params['uid'] = isset($_SESSION['uid']) ? $_SESSION['uid'] : 0;
$params['uname'] = isset($_SESSION['uname']) ? $_SESSION['uname'] : '';
$params['info_title'] = $info_title;
$params['info_id'] = $info_id;
$params['order_receive'] = preg_replace('~<[^>]*>~','','收货人：'.$_POST['rev_user'].chr(10).'手机：'.$_POST['rev_phone'].chr(10).'收货地址：'.$_POST['rev_addr']);
$params['create_time'] = time();//die(print_r($params));
//入库
if(isset($_SESSION['postdata']['gov_order']) && (time()-$_SESSION['postdata']['gov_order']<30)) die('{"code":"101","msg":"请不要重复提交订单"}');
$res = $dbm->single_insert(TB_PREFIX."order",$params);
```
可以看到 info_title 是解码来的 所以就无视了全局的转义。、
然后带入了
```
public function single_insert($table_name, $fields, $type = 0) {
if (!is_array($fields) || count($fields) == 0) return array('sql' => '', 'error' => '插入失败，插入字段为空', 'sql_time' => 0, 'autoid' => 0);
$sql_field = "";
$sql_value = "";
// 遍历字段和值
foreach($fields as $key => $value) {
$sql_field .= ",$key";
$sql_value .= ",'$value'";
}
$sql_field = substr($sql_field, 1);
$sql_value = substr($sql_value, 1);
if ($type == 0) {
$sql = "insert ignore into $table_name ($sql_field) values ($sql_value)"; //组合SQL
} else {
$sql = "replace into $table_name ($sql_field) values ($sql_value)"; //组合SQL
}
echo $sql;
exit;
$result = $this -> query_insert($sql);
```
组合语句 这里 我直接把语句输出来
### 漏洞证明：
[<img src="https://images.seebug.org/upload/201404/12212241ce7cb8fc4f9008910c310018c4596471.jpg" alt="m1.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201404/12212241ce7cb8fc4f9008910c310018c4596471.jpg)
[<img src="https://images.seebug.org/upload/201404/122123020e71ec54bd2b11863ff4ca1164b9b96a.jpg" alt="M2.Jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201404/122123020e71ec54bd2b11863ff4ca1164b9b96a.jpg)
相等即延时。
京公网安备 11010502034610号
暂无评论